Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

678484 source statements · aliases may refer to the same vulnerability

CVE-2026-35371Published

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a nam…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.3Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-40073Published

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. T…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-41180Published

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under `/files/:uploadId` validates the mounted request path using the still-encoded `req.path`, but the downstream tus handler l…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-41492Published

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "tok…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-41679Published

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance…

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-112242Published

WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability

cve-program ·

https://wordpress.org/plugins: profile-builder

CVSS 3.1 8.8Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116095Published

smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation

cve-program ·

Vendor product: smg

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-11998Published

A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session.

nvd ·

CVSS 3.1 · 36c7be3b-2937-45df-85ea-ca7133ea542c · Secondary 7.6 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.6Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-116094Published

EyouCMS function.php remote_file_to_local server-side request forgery

cve-program ·

Vendor product: EyouCMS

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18204Published

Malicious code in @factiii/runner (npm)

osv · GHSA-9j83-qj34-g5vc

npm: @factiii/runner

Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-11720Published

A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox.

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-13149Published

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), …

nvd ·

CVSS 4.0 · 22e2d327-25fe-45d7-9f0c-dcd23b7108df · Secondary 7.7Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-41052Published

Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.4 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-41053Published

Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-102870Published

Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 25 Oct 2026Recorded 27 Oct 2026

MAL-2026-18293Published

Malicious code in w-mousekey (npm)

osv · GHSA-gmhr-j769-j6qf

npm: w-mousekey

Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116062Published

SourceCodester Performance Indicator System save_profile.php sql injection

cve-program ·

Vendor product: Performance Indicator System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116061Published

SourceCodester Performance Indicator System edit_dealer.php sql injection

cve-program ·

Vendor product: Performance Indicator System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-33646Published

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes .tool-versions files through the Tera template engine during parsing, with the exec() function registered, enabling arbitrary command executi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.6Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-39822Published

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.8Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-41579Published

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and 1.5.0-rc.1, when setting up the container rootfs, setupPtmx and setupDevSymlinks…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.3Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-115824Published

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

cve-program ·

https://cpan.org/modules: Starman

Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-115823Published

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections

cve-program ·

https://cpan.org/modules: Starman

Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-115822Published

Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies

cve-program ·

https://cpan.org/modules: Starman

Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-115817Published

Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers

cve-program ·

https://cpan.org/modules: Starman

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18292Published

Malicious code in event-bus-lite-testmetest (npm)

osv ·

npm: event-bus-lite-testmetest

Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-13760Published

OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary com…

nvd ·

CVSS 4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 7.0 · CVSS 3.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 7.3Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-116058Published

Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection

cve-program ·

Vendor product: Activiti

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116057Published

KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload

cve-program ·

Vendor product: KodExplorer

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18064Published

Malicious code in sc-announcer (npm)

osv ·

npm: sc-announcer

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-5780Published

Malicious code in ing-feat-itsme-oidc-authentication (npm)

osv ·

npm: ing-feat-itsme-oidc-authentication

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18280Published

Malicious code in @futurae-public/adaptive-js (npm)

osv ·

npm: @futurae-public/adaptive-js

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18291Published

Malicious code in sc-hydrate-carousel-price (npm)

osv ·

npm: sc-hydrate-carousel-price

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-17928Published

Malicious code in @fcsmc/commercial-analytics (npm)

osv ·

npm: @fcsmc/commercial-analytics

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18278Published

Malicious code in @factoryz/apollo (npm)

osv ·

npm: @factoryz/apollo

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18279Published

Malicious code in @fmr-ap153177/apex-kit-icons (npm)

osv ·

npm: @fmr-ap153177/apex-kit-icons

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18061Published

Malicious code in ccl-global-shopping (npm)

osv ·

npm: ccl-global-shopping

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-12800Published

Malicious code in sc-font-icons (npm)

osv ·

npm: sc-font-icons

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18284Published

Malicious code in @jm-telefonica/multibrand-components (npm)

osv ·

npm: @jm-telefonica/multibrand-components

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-12435Published

Malicious code in sc-geeksquad-core (npm)

osv ·

npm: sc-geeksquad-core

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-17564Published

Malicious code in tostpro (npm)

osv · GHSA-x5qq-j2hm-34m3

npm: tostpro

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-17929Published

Malicious code in @fmr-ap149494/apex-base-component (npm)

osv ·

npm: @fmr-ap149494/apex-base-component

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18062Published

Malicious code in sc-wizard (npm)

osv ·

npm: sc-wizard

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18281Published

Malicious code in @generic-means/ing-feat-scanner-libs (npm)

osv ·

npm: @generic-means/ing-feat-scanner-libs

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18285Published

Malicious code in @postex/common (npm)

osv ·

npm: @postex/common

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18289Published

Malicious code in paychex-pdftron (npm)

osv ·

npm: paychex-pdftron

Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-14722Published

A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. This impacts an unknown function of the file src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts of the component Git Repository Import. The manipulation result…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5 · CVSS 3.1 · [email protected] · Secondary 7.3 · CVSS 2.0 · [email protected] · Secondary 7.5Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-20706Published

Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 9.1Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-20779Published

Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.

nvd ·

CVSS 3.1 · 88ee5874-cf24-4952-aea0-31affedb7ff2 · Secondary 7.1Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-20896Published

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

nvd ·

CVSS 3.1 · 88ee5874-cf24-4952-aea0-31affedb7ff2 · Secondary 9.8Source modified 25 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.